xref: /webtrees/app/Http/Middleware/CheckCsrf.php (revision e873f434551745f888937263ff89e80db3b0f785) 
1<?php
2
3/**
4 * webtrees: online genealogy
5 * Copyright (C) 2023 webtrees development team
6 * This program is free software: you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation, either version 3 of the License, or
9 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program. If not, see <https://www.gnu.org/licenses/>.
16 */
17
18declare(strict_types=1);
19
20namespace Fisharebest\Webtrees\Http\Middleware;
21
22use Fig\Http\Message\RequestMethodInterface;
23use Fisharebest\Webtrees\FlashMessages;
24use Fisharebest\Webtrees\Http\RequestHandlers\Logout;
25use Fisharebest\Webtrees\Http\RequestHandlers\SelectLanguage;
26use Fisharebest\Webtrees\Http\RequestHandlers\SelectTheme;
27use Fisharebest\Webtrees\I18N;
28use Fisharebest\Webtrees\Session;
29use Fisharebest\Webtrees\Validator;
30use Psr\Http\Message\ResponseInterface;
31use Psr\Http\Message\ServerRequestInterface;
32use Psr\Http\Server\MiddlewareInterface;
33use Psr\Http\Server\RequestHandlerInterface;
34
35use function in_array;
36
37/**
38 * Middleware to wrap a request in a transaction.
39 */
40class CheckCsrf implements MiddlewareInterface
41{
42    private const array EXCLUDE_ROUTES = [
43        Logout::class,
44        SelectLanguage::class,
45        SelectTheme::class,
46    ];
47
48    /**
49     * @param ServerRequestInterface  $request
50     * @param RequestHandlerInterface $handler
51     *
52     * @return ResponseInterface
53     */
54    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
55    {
56        if ($request->getMethod() === RequestMethodInterface::METHOD_POST) {
57            $route = Validator::attributes($request)->route();
58
59            if (!in_array($route->name, self::EXCLUDE_ROUTES, true)) {
60                $params        = (array) $request->getParsedBody();
61                $client_token  = $params['_csrf'] ?? $request->getHeaderLine('X-CSRF-TOKEN');
62                $session_token = Session::get('CSRF_TOKEN');
63
64                unset($params['_csrf']);
65
66                $request = $request->withParsedBody($params);
67
68                if ($client_token !== $session_token) {
69                    if ($client_token === '') {
70                        FlashMessages::addMessage(I18N::translate('The form data is incomplete. Perhaps you need to increase max_input_vars on your server?'));
71                    } else {
72                        FlashMessages::addMessage(I18N::translate('This form has expired. Try again.'));
73                    }
74
75                    return redirect((string) $request->getUri());
76                }
77            }
78        }
79
80        return $handler->handle($request);
81    }
82}
83